# US 12,603,896 B2 · Agent prevention augmentation based on organizational learning > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,603,896 B2 - Document ID: US12603896B2 - Status: Granted - Kind: B2 - Application number: 17/676,275 - Filed: 2022-02-21 - Published: 2023-08-24 - Granted: 2026-04-14 - Earliest claimed: 2022-02-21 - Assignees: Palo Alto Networks, Inc. - Applicants: Palo Alto Networks (Israel Analytics) Ltd. - Inventors: Jonathan Allon; Niv Sela; Liav Zigelbaum; Guy Pilosof; Ori Beck - Web page: https://patentgrep.com/patent/US12603896B2 ## CPC - G06F 21/554: {involving event detection and direct action} - H04L 63/1416: {Event detection, e.g. attack signature detection} - G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A method, including collecting, by a security server, reports from multiple computing devices of events belonging to a set of specified event types occurring in execution of software processes on the devices, and collating the reports in the server to extract context information with respect to each of the events. Upon detecting an event occurring in execution of a process on a given device and matching one of the types, a software agent executing on the given device extracts, one or more features from the detected event, and conveys a query with respect to the detected event from the agent to the server. Upon receiving, from the server in response to the query, the context information with respect to the detected event, the agent decides to initiate a protective action on the given device based on the received context information and the one or more features extracted by the agent. ## Claims ### Claim 1 A method for computer protection, comprising: detecting, by a security agent running on an endpoint computing device, an event of given event type associated with suspicious behavior occurring in execution of a software process by the endpoint computing device; conveying a query with respect to the event type over a network from the security agent to a security server; receiving, from the security server in response to the query, context information with respect to the event type based on collation of event reports from multiple endpoint computing devices; extracting, by the security agent, one or more features from the detected event; making a real-time decision, by the security agent, whether to block the suspicious behavior on the endpoint computing device based on the context information received from the security server and the one or more features extracted by the security agent, wherein the context information comprises a profile for the given event type, the profile comprising a set of profile features and a corresponding set of feature weights, wherein the feature weights are determined based on at least one of a frequency and a recency of the profile features in event records, and wherein making the real-time decision comprises computing a suspiciousness score by applying the feature weights to the one or more features extracted from the detected event wherein less frequent or less recent feature combinations are weighted to produce a higher suspiciousness score; and initiating a protective action by the security agent on the endpoint computing device in response to the decision. ### Claim 2 (depends on 1) The method according to claim 1, wherein the event reports comprise event logs maintained by the computing devices. ### Claim 3 (depends on 1) The method according to claim 1, wherein ARM a making the real-time decision comprises modeling the one or more features. ### Claim 4 (depends on 1) The method according to claim 1, wherein the context information comprises a frequency of occurrence of the event type on other endpoint computing devices in the network. ### Claim 5 (depends on 1) The method according to claim 1, wherein the context information comprises a recency of occurrence of the event type on other endpoint computing devices in the network. ### Claim 6 (depends on 1) The method according to claim 1, wherein the event comprises receiving a file via the network at the endpoint computing device. ### Claim 7 (depends on 6) The method according to claim 6, wherein initiating the protective action comprises preventing the endpoint computing device from storing the file to a storage device. ### Claim 8 (depends on 6) The method according to claim 6, wherein initiating the protective action comprises preventing the endpoint computing device from accessing the file. ### Claim 9 (depends on 1) The method according to claim 1, wherein the event comprises establishing a connection between the endpoint computing device and a web site. ### Claim 10 (depends on 9) The method according to claim 9, wherein initiating the protective action comprises closing the connection. ### Claim 11 (depends on 1) The method according to claim 1, wherein initiating the protective action comprises terminating execution of the software process. ### Claim 12 (depends on 1) The method according to claim 1, wherein the context information comprises an identifier of a software application usually associated with the event type. ### Claim 13 An endpoint computing device, comprising: a memory configured to store a security agent; and a processor configured to execute the security agent so as to detect an event of given event type associated with suspicious behavior occurring in execution of a software process by the endpoint computing device, to convey a query with respect to the event type over a network from the security agent to a security server, to receive, from the security server in response to the query, context information with respect to the event type based on collation of event reports from multiple endpoint computing devices, wherein the security agent is configured to extract one or more features from the detected event, to make a real-time decision whether to block the suspicious behavior on the endpoint computing device based on the context information received from the security server and the one or more features extracted by the security agent, wherein the context information comprises a profile for the given event type, the profile comprising a set of profile features and a corresponding set of feature weights, wherein the feature weights are determined based on at least one of a frequency and a recency of the profile features in event records, and wherein making the real-time decision comprises computing a suspiciousness score by applying the feature weights to the one or more features extracted from the detected event, wherein less frequent or less recent feature combinations are weighted to produce a higher suspiciousness score, and to initiate a protective action by the security agent on the endpoint computing device in response to the decision. ### Claim 14 A computer software product, comprising a non-transitory computer-readable medium, in which program instructions are stored, which instructions, when read by a processor in an endpoint computing device, cause the processor to execute a security agent so as to detect an event of given event type associated with suspicious behavior occurring in execution of a software process by the endpoint computing device, to convey a query with respect to the event type over a network from the security agent to a security server, to receive, from the security server in response to the query, context information with respect to the event type based on collation of event reports from multiple endpoint computing devices, wherein the instructions cause the security agent to extract one or more features from the detected event, to make a real-time decision whether to block the suspicious behavior on the endpoint computing device based on the context information received from the security server and the one or more features extracted by the security agent, wherein the context information comprises a profile for the given event type, the profile comprising a set of profile features and a corresponding set of feature weights, wherein the feature weights are determined based on at least one of a frequency and a recency of the profile features in event records, and wherein making the real-time decision comprises computing a suspiciousness score by applying the feature weights to the one or more features extracted from the detected event, wherein less frequent or less recent feature combinations are weighted to produce a higher suspiciousness score, and to initiate a protective action by the security agent on the endpoint computing device in response to the decision. ### Claim 15 (depends on 14) The product according to claim 14, wherein making the real-time decision comprises modeling the one or more features. ### Claim 16 (depends on 14) The product according to claim 14, wherein the context information comprises a frequency of occurrence of the event type on other endpoint computing devices in the network. ### Claim 17 (depends on 14) The product according to claim 14, wherein the context information comprises a recency of occurrence of the event type on other endpoint computing devices in the network. ### Claim 18 (depends on 14) The product according to claim 14, wherein the event comprises receiving a file via the network at the endpoint computing device. ### Claim 19 (depends on 14) The product according to claim 14, wherein the event comprises establishing a connection between the endpoint computing device and a web site. ### Claim 20 (depends on 14) The product according to claim 14, wherein initiating the protective action comprises terminating execution of the software process. ### Claim 21 (depends on 14) The product according to claim 14, wherein the context information comprises an identifier of a software application usually associated with the event type.